fix(security): surface swallowed permission-set resolution failures (#2565)

[os-zhuang]

概述

修复 #2565(2026-07-04 授权架构评估中发现的可观测性缺口):PermissionEvaluator.resolvePermissionSets 静默吞掉 metadata list() 和 sys_permission_set dbLoader 的异常。方向是对的(fail-closed:解析不到的权限集不授予任何权限),但一次瞬时 DB 抖动会让自定义权限集无声消失,由此产生的 403 无从排查。

变更

• evaluator 增加可选 { logger } 参数,两个 catch 各发一条 warn,带上未解析的权限集名字 + 错误信息
• SecurityPlugin 在两处调用点(主解析 + fallback)注入其插件 logger
• 解析行为逐字节不变——纯日志增强

验证

• 3 个新单测:dbLoader 抛错时 warn + 继续解析已解析集、metadata list() 抛错时 warn + 走 bootstrap、无 logger 时静默(向后兼容)
• plugin-security 全套测试通过

关联

• [security][observability] resolvePermissionSets swallows dbLoader failures silently — custom permission sets vanish with no log #2565 · [umbrella][security] 授权全生命周期缺口地图 — 包开发 → 生产上线(P0–P3) #2561 P2(权限解析可观测性)· 评估来源 PR feat(security)!: secure-by-default requireAuth flip + RBAC gates for transfer/restore/purge (#2561 P0) #2562

🤖 Generated with Claude Code

https://claude.ai/code/session_014y5kiH3aPLWtRRRGcVrXcT

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 4, 2026 8:42am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security.

10 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/implementation-status.mdx(via @objectstack/plugin-security)
• content/docs/concepts/packages.mdx(via @objectstack/plugin-security)
• content/docs/getting-started/cli.mdx(via @objectstack/plugin-security)
• content/docs/guides/cheatsheets/permissions-matrix.mdx(via packages/plugins/plugin-security)
• content/docs/guides/metadata/dashboard.mdx(via @objectstack/plugin-security)
• content/docs/guides/packages.mdx(via @objectstack/plugin-security)
• content/docs/guides/plugins.mdx(via @objectstack/plugin-security)
• content/docs/guides/security.mdx(via @objectstack/plugin-security)
• content/docs/guides/solutions/data-automation-interface-access.mdx(via packages/plugins/plugin-security)
• content/docs/guides/solutions/role-based-interfaces.mdx(via packages/plugins/plugin-security)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.